Most of the biggest and Famous sites are found to be Vulnerable to XSS attack. Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. The vulnerability can be used by attackers to bypass access controls such as the same origin policy. Recently, vulnerabilities of this kind have been exploited to craft powerful phishing attacks and browser exploits. The hacker with code name “Invectus” list some such famous sites with XSS vulnerability.
Source: https://thehackernews.com/2011/09/20-famous-websites-vulnerable-to-cross.html